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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 



1. (Original) A computer program product comprising a computer program 
operable to control a computer to reverse an alteration to a stored computer file, said 
computer program comprising: 

file comparing logic operable to compare said stored computer file with an archive 
copy of said computer file stored when said stored computer file was created; and 

alteration reversal logic operable if said file comparing logic detects that said 
stored computer file and said archive computer file do not match to replace said stored 
computer file with said archive copy of said computer file. 



2. ( Original) A computer program product as claimed in claim 1, wherein said 
archive copy of said computer file is stored in one of: 
an unencrypted form; 
an encrypted form; 
an encrypted media; 
an encrypted volume; and 
a PGP disk. 
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3. (Original) A computer program product as claimed in claim 1, wherein said 
archive copy of said computer file is stored in one of: 

a different physical storage device to said stored computer file; and 

a different part of a common physical storage device shared with stored computer 

file. 




4. (Original) A computer program product as claimed in claim 1, wherein a subset 
of file types stored by said computer are subject comparison by said file comparing logic 
and to creation of an archive copy for use with said file comparing logic. 

5. ( Original) A computer program product as claimed in claim 4, wherein said 
subset of file types include one or more of: 

executable file types; and 
dynamic link library file types. 



6. (Original) A computer program product as claimed in claim 1, comprising 
archive file copy logic operable upon creation of said stored computer file to also created 
said archive copy of said computer file. 
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7. (Original) A computer program product as claimed in claim 6, wherein said 
archive file copy logic operates to create said archive copy of said computer file for a 
subset of file types stored by said computer. 

8. (Original) A computer program product as claimed in claim 7, wherein said 
subset of file types include one or more of: 

executable file types; and 
dynamic link library file types. 

9. (Original) A computer program product as claimed in claim 1, wherein said 
alteration is a malicious alteration. 

10. (Original) A method of detecting a malicious alteration to a stored computer 
file, said method comprising the steps of: 

comparing said stored computer file with an archive copy of said computer file- 25 
stored when said stored computer file was created; and 

if said file comparing step detects that said stored computer file and said archive 
computer file do not match, replacing said stored computer file with said archive copy of 
said computer file. 
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11. (Original) A method as claimed in claim 10, wherein said archive copy of said 
computer file is stored in one of: 

an unencrypted form; 
an encrypted form; 
an encrypted media; 
an encrypted volume; and 
a PGP disk. 

12. (Original) A method as claimed in claim 10, wherein said archive copy of said 
computer file is stored in one of: 

a different physical storage device to said stored computer file; and 

a different part of a common physical storage device shared with stored computer 

file. 

13. (Original) A method as claimed in claim 10, wherein a subset of file types 
stored by said computer are subject comparison by said file comparing logic and to 
creation of an is archive copy for use in said comparing step. 

14. (Original) A method as claimed in claim 13, wherein said subset of file types 
include one or more of: 
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executable file 
dynamic link li 

15. (Original) A method as claimed in claim 10, comprising the step of upon 
creation of said stored computer file also creating said archive copy of said computer file. 

16. (Original) A method as claimed in claim 15, wherein said step of creating said 
archive copy operates to create said archive copy of said computer file for a subset of file 
types stored by said computer. 

17. (Original) A method as claimed in claim 16, wherein said subset of file types 
include one or more of: 

executable file types; and 
dynamic link library file types. 

18. (Original) A method as claimed in claim 10, wherein said alteration is a 
malicious alteration. 

19. (Currently Amended) Apparatus for processing data operable to detect an 
alteration to a stored computer file, said apparatus comprising: 



es; and 

ry file types. 



-8- 



804528 



WOLFF et al. 
Appl. No. 09/854,457 
January 2, 2004 

a file comparitor comparator operable to compare said stored computer file with an 
archive copy of said computer file stored when said stored computer file was created; and 

a comparison responder operable if said file comparing logic detects that said 
stored computer file and said archive computer file do not match to replace said stored 
computer file with said archive copy of said computer file. 




20. (Original) Apparatus as claimed in claim 19, wherein said archive copy of said 
computer file is stored in one of: 

an unencrypted form; 
an encrypted form; 
an encrypted media; 
an encrypted volume; and 
a PGP disk. 

21. (Original) Apparatus as claimed in claim 19, wherein said archive copy of said 
computer file is stored in one of: 

a different physical storage device to said stored computer file; and 

a different part of a common physical storage device shared with stored computer 

file. 
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22. (Currently Amended) Apparatus as claimed in claim 19, wherein a subset of 
file types stored by said computer are subject comparison by said file 
comparitor comparator and to creation of an archive copy for use with said file 
comparitor comparator . 

23. (Original) Apparatus as claimed in claim 22, wherein said subset of file types 
include one or more of: 

executable file types; and 
dynamic link library file types. 

24. (Currently Amended) Apparatus as claimed in claim 19, comprising an archive 
file copier operable upon creation of said stored computer file to also efeated create said 
archive copy of said computer file. 

25. (Original) Apparatus as claimed in claim 24, wherein said archive file copier 
operates to create said archive copy of said computer file for a subset of file types stored 
by said computer. 

26. (Original) Apparatus as claimed in claim 25, wherein said subset of file types 
include one or more of: 

executable file types; and 
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dynamic link library file types. 



27. (Original) Apparatus as claimed in claim 19, wherein said alteration is a 
malicious alteration. 



